CVE-2013-1656

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1)…

published March 8, 2013

CVSS
—
EPSS
2%
Percentile
74.6
In the wild
Unconfirmed
What it is

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01531 · 74.6th percentile
Published
2013-03-08T18:00Z
EPSS history
Timeline
  • 08 MAR 18:00Z
    Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1)…
    cvelistv5